{"id":106630,"date":"2023-02-03T12:48:25","date_gmt":"2023-02-03T10:48:25","guid":{"rendered":"https:\/\/prohoster.info\/?p=106630"},"modified":"2023-02-03T21:50:37","modified_gmt":"2023-02-03T19:50:37","slug":"vypusk-openssh-9-2-s-ustraneniem-uyazvimosti-proyavlyayushhejsya-na-etape-do-autentifikaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-openssh-9-2-s-ustraneniem-uyazvimosti-proyavlyayushhejsya-na-etape-do-autentifikaczii","title":{"rendered":"Udgivelsen af OpenSSH 9.2 med l\u00f8sning p\u00e5 en s\u00e5rbarhed, der viser sig f\u00f8r godkendelse","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
OpenSSH 9.2 er udgivet, som er en open source-implementering af klient og server til brug med SSH 2.0- og SFTP-protokoller. I den nye version er en s\u00e5rbarhed, der f\u00f8rer til dobbelt frigivelse af hukommelse f\u00f8r afslutning af autentificering, blevet rettet. Kun OpenSSH 9.1-versionen er s\u00e5rbar, og problemet optr\u00e6der ikke i tidligere versioner. <\/p>\n
For the vulnerability to manifest, it is sufficient to change the SSH client's banner to «SSH-2.0-FuTTYSH_9.1p1» to achieve the flags «SSH_BUG_CURVE25519PAD» and «SSH_OLD_DHGEX», which depend on the version of the SSH client. After setting these flags, the memory for the buffer «options.kex_algorithms» is freed twice \u2014 first during the do_ssh2_kex() function, which calls compat_kex_proposal(), and then during the do_authentication2() function, which chains to input_userauth_request(), mm_getpwnamallow(), copy_set_server_options(), assemble_algorithms(), and kex_assemble_names(). <\/p>\n
Creating a working exploit for this vulnerability is considered unlikely, as the exploitation process is too complicated \u2014 modern memory allocation libraries provide protection against double memory freeing, and the pre-auth process, where the bug exists, runs with reduced privileges in an isolated sandbox environment. <\/p>\n
Udover den n\u00e6vnte s\u00e5rbarhed er der ogs\u00e5 rettet yderligere to sikkerhedsproblemer i den nye version: <\/p>\n
\n
An error in handling the «PermitRemoteOpen» setting causes the first argument to be ignored if it differs from the values «any» and «none». This problem appears in versions newer than OpenSSH 8.7 and leads to bypassing the check when only one privilege is specified.\n
An attacker controlling the DNS server used for name resolution can achieve the substitution of special characters (e.g., «*») in the known_hosts files if the configuration has the CanonicalizeHostname and CanonicalizePermittedCNAMEs options enabled, and the system resolver does not verify the correctness of the responses from the DNS server. Conducting such an attack is considered unlikely as the returned names must meet the conditions specified by CanonicalizePermittedCNAMEs. <\/ul>\n
Andre \u00e6ndringer: <\/p>\n
\n
In ssh_config for ssh, a new setting EnableEscapeCommandline has been added, controlling the handling of the client-side escape sequence «~C», which provides a command line. By default, the handling of «~C» is now disabled to provide a stricter sandbox isolation, which could potentially disrupt the operation of systems where «~C» is used for port redirection during operation.\n
I sshd_config for sshd er der tilf\u00f8jet direktivet ChannelTimeout til at angive timeout for uvirksomhed p\u00e5 kanalen (kanaler, hvor der ikke er registreret trafik i den angivne tid, vil automatisk blive lukket). For session, X11, agent og trafikvideresendelse kan der angives forskellige timeouts.\n
I sshd_config for sshd er der tilf\u00f8jet direktivet UnusedConnectionTimeout, der muligg\u00f8r angivelse af timeout for afslutning af klientforbindelser, der har v\u00e6ret inaktive i en bestemt tid uden aktive kanaler.\n
In sshd, the «-V» option has been added to display the version, similar to the corresponding option in the ssh client.\n
The output of «ssh -G» now includes a line «Host», reflecting the value of the argument with the hostname.\n
I scp og sftp er der tilf\u00f8jet en mulighed «-X» til at styre SFTP-protokollens parametre, s\u00e5som st\u00f8rrelsen p\u00e5 kopi-bufferen og antallet af ventende foresp\u00f8rgsler.\n
I ssh-keyscan er det nu muligt at scanne hele CIDR-adresseomr\u00e5der, for eksempel «ssh-keyscan 192.168.0.0\/24». <\/ul>\n